Security Operations Analyst - Tier 1

Knox runs the largest Federal and DoW managed cloud, building and operating secure cloud and AI environments that support the U.S. government’s most critical missions — from national security and public safety to essential public services. Our customers rely on Knox to deploy production systems that meet the highest standards for security, reliability, and compliance.

Knox runs the largest Federal and DoW managed cloud, building and operating secure cloud and AI environments that support the U.S. government’s most critical missions — from national security and public safety to essential public services. Our customers rely on Knox to deploy production systems that meet the highest standards for security, reliability, and compliance.

Work at Knox is high-impact and purpose-driven. The problems we solve are high-stakes, the expectations are high, and the results are visible. Speed, rigor, and trust matter here - because the environments we secure cannot fail. Your contributions are visible, your expertise is relied upon, and the impact of your work is immediate and measurable. We operate at federal scale, securing some of the most sensitive government environments in the country - because the systems we build must perform without fail.

Most companies run a security team and a network team separately. We don’t. At Knox one team watches everything — performance, availability and security — out of the same queue. You see the whole picture, and a problem never sits with the wrong team while the clock runs. It is a better way to work and a much faster way to learn.

• Active intrusion or suspected compromise
• Service-affecting outage
• Degradation and early warning signs
• Customer requests and tickets

Higher priorities always come first. You will not be asked to finish a routine ticket while a live alert is open.

• Work a full shift on either a weekday or a four-day rotation schedule, and hand over with a written log.
• Review alerts and decide what to do — accelerate, contain, or close with your reasoning noted.
• Handle performance and availability issues alongside security ones, out of the same queue.
• Follow our runbooks for containment and call the senior analyst on duty when a runbook runs out.
• Work customer requests and tickets once the higher priorities are clear.
• Leave notes the next shift can pick up without having to call you.

• CompTIA Security+ or an equivalent certification, or the ability to earn it within 90 days of starting.
• Hands-on experience in IT operations, a help desk, a network operations center, or something similar.
• Good judgment about when to elevate, and comfort working on your own if the shift you take is an overnight.

• Cloud security monitoring, SIEM tools, and how to tune detections.
• How FedRAMP controls work in practice, and how we evidence them.
• Incident containment, network troubleshooting, and our runbooks.
• The path to Tier 2, usually around three years.

• A degree.
• Previous corporate experience.
• An active security clearance. If you hold one, or held one, that’s a plus — it is never a requirement.

• Your schedule is fixed and published ahead of time. Shifts do not rotate.
• Three consecutive days off every week on the four-day rotation schedules.
• Certification costs and renewals covered, including the first attempt and a retake.
• Shift premium paid on the hours you actually work in a premium window, at a published rate.
• A published salary band, and a published band for the level above you.
• We are a small team, so what you do is visible. You will make an impact.

Due to…